March 2019 - Freeradius-Users - lists.freeradius.org

UDP Lost Packets
by Oscar 09 Mar '19

09 Mar '19

Hi, At the moment I have arroung 1.000 mikrotik routers with hotspot using freeRadius as auth and account. The radius server is on AWS Frankfurt and most of the clients are working ok. But there are some (10 or so) cliens that are losing always udp packets and arround 10% of request are lost. And also Form this locations some days the lost packets from that lacations increase to 100% . I can solve this routing the radius to a VPN directly from the router to the radius server and the 0% of lost packets. I've found this doc: <https://www.rfc-editor.org/pdfrfc/rfc6613.txt.pdf> https://www.rfc-editor.org/pdfrfc/rfc6613.txt.pdf And I really sure that the problem is that on some clients the packets are lost probably by the fragmentation of the udp packet that get lost. And when the ISP from that clients update, or change or noone knows why the result is that our upd radius packets are all lost. Anyone know if there is something I can do to improve this ? I've tried to change MTU on mikrotik but not success. Thanks,

2 1

Integrate ldap query to freeradius
by Boudjoudad Abdelkader 08 Mar '19

08 Mar '19

Hello, How can i integrate this ldap query in freeradius authentication to get the group name of user ? ldapsearch -h server.example.com -p 389 -x -W -D "cn=Directory Manager" "uid=username" | grep memberOf | awk '{print $2}' | cut -d ',' -f -1 Thanks,

4 4

Counter Attribute Mikrotik-Total-Limit Must be Integer64
by One Zero Art 08 Mar '19

08 Mar '19

Hi, Trying to prevent authorization of users after usage limited data. I have set sqlcounter for this but debug mode showing this error "counter Attribute Mikrotik-Total-Limit Must be Integer64". Inserted "Mikrotik-Total-Limit" in radcheck. I have set other counter but those were working fine. Searched google but no luck. I also check default Mikrotik dictionary, Mikrotik-Total-Limit exist there with interger and id 17. Should I changed that or how can I update attribute? I am using Ubuntu 18.4 and Freeradius 3.0.16 Thank

3 3

Help on What is the preferred OpenSSL version for freeradius 3.16
by shivu prasad 07 Mar '19

07 Mar '19

Hi All, We have in the process to release our module on top of the freeradius server , can you let me know what is the preferred OpenSSL version for freeradius 3.16 so that we can add it in pre-requisite for customers? Regards, Shivaprasad

3 4

problem with outer and inner (User-Name).
by dg 06 Mar '19

06 Mar '19

Hello, can anyone help ? I have problem with identity. I am testing it with windows 7 and my cisco switch - ethernet. when i log in (and using identity ) i have in logs: Mon Mar 4 18:23:07 2019 : Auth: (36) Login OK: [tom/<via Auth-Type = eap>] (from client SW1 port 0 via TLS tunnel) Mon Mar 4 18:23:07 2019 : Auth: (37) Login OK: [whatever/<via Auth-Type = eap>] (from client SW1 port 50002 cli A1-A2-04-E7-5C-8D) i know that radius logs what its get from NAS but in this case i have problem with accounting (its log "whatever" instead of "tom") i know that to log the inner User-Name, it needs to be copied from the inner-tunnel to the outer. in /etc/raddb/sites-enabled/inner-tunnel in post-auth i have update outer.session-state { &User-Name := &User-Name } i also tried (from FreeRADIUS Begginers's Guide): if(outer.request:User-Name != request:User-Name) update reply { User-Name := "%{request:User-Name}" } } but in logs when i trying to log in i still have: Mon Mar 4 18:23:07 2019 : Auth: (36) Login OK: [tom/<via Auth-Type = eap>] (from client SW1 port 0 via TLS tunnel) Mon Mar 4 18:23:07 2019 : Auth: (37) Login OK: [whatever/<via Auth-Type = eap>] (from client SW1 port 50002 cli A1-A2-04-E7-5C-8D) in /etc/raddb/mods-enabled/eap i have "use_tunneled_reply = yes" what am i doing wrong ? can anyone help ? i have FreeRADIUS Version 3.0.15 best regards

2 1

double quotes in Tunnel-Private-Group-Id
by Marc Boisis 06 Mar '19

06 Mar '19

We migrate from freeradius 2.2.5 to a new server in 3.0.13 The attribute Tunnel-Private-Group-Id come from same ldap server between the two freeradius server . With 2.2.5 : Access-Accept Id 105 from 10.10.10.21:1812 to 10.10.10.21:44901 length 0 Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN With 3.0.13 : Access-Accept Id 105 from 10.10.10.21:1812 to 10.10.10.21:44901 length 0 (20) Tunnel-Type := VLAN (20) Tunnel-Medium-Type := IEEE-802 (20) Tunnel-Private-Group-Id := "\"2\"" Why there is backslashed double quote in the value with the 3.0.13 and what can I do to remove them, my clients doesn't understand them ? Thanks

2 2

Freeradius v3.0.16 - CONSISTENCY CHECK FAILED
by andrea.mucci＠acrmnet.it 06 Mar '19

06 Mar '19

Hi all, we would like to ask your help to understand the ERROR below: CONSISTENCY CHECK FAILED src/lib/pair.c[268]: VALUE_PAIR "SQL-User-Name" char buffer not \0 terminated SOFT ASSERT FAILED src/lib/pair.c[2348]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 19 frames: /usr/lib64/freeradius/libfreeradius-radius.so(fr_fault+0xa7)[0x7f80a609a5a7] /usr/lib64/freeradius/libfreeradius-radius.so(+0xd86b)[0x7f80a609a86b] /usr/lib64/freeradius/libfreeradius-radius.so(fr_pair_add+0x7b3)[0x7f80a60a6 7b3] /usr/lib64/freeradius/rlm_sql.so(sql_set_user+0xc2)[0x7f80a081dd32] /usr/lib64/freeradius/rlm_sql.so(+0x57bc)[0x7f80a08207bc] /usr/sbin/radiusd[0x4272ff] /usr/sbin/radiusd[0x427e29] /usr/sbin/radiusd[0x426bde] /usr/sbin/radiusd[0x427e29] /usr/sbin/radiusd[0x426bde] /usr/sbin/radiusd[0x427e29] /usr/sbin/radiusd[0x426bde] /usr/sbin/radiusd(modcall+0x56)[0x427ee6] /usr/sbin/radiusd(indexed_modcall+0xad)[0x42269d] /usr/sbin/radiusd(rad_authenticate+0x3f6)[0x4111f6] /usr/sbin/radiusd[0x437b07] /usr/sbin/radiusd[0x42f973] /usr/lib64/libpthread.so.0(+0x7e25)[0x7f80a48eae25] /usr/lib64/libc.so.6(clone+0x6d)[0x7f80a419b34d] No panic action set Best Regards Andrea

2 1

Group ID of user
by Boudjoudad Abdelkader 05 Mar '19

05 Mar '19

Hello, I'm new with freeradius, we have a ldap and freeradius server connected, the authentication via ldap works fine, how can i return the group ID of user with the Accept-Accept ? Thanks,

2 1

SqlCounter Error
by One Zero Art 05 Mar '19

05 Mar '19

Hi I am newbie in freeradius. Thank you for support. :) I have enabled sqlcounter in mods-enabled directory. When I debug freeradius -X Its giving this error including configuration file /etc/freeradius/3.0/mods-enabled/sqlcounter /etc/freeradius/3.0/mods-enabled/sqlcounter[43]: Reference "${modules.sql.dialect}" not found /etc/freeradius/3.0/mods-enabled/sqlcounter[52]: Reference "${modconfdir}/sql/counter/${dialect}/${.:instance}.conf" points to a variable which has not been expanded. Errors reading or parsing /etc/freeradius/3.0/radiusd.conf I have already tried method from this post. Found on mail list. If I changed in radiusd.conf then its saying duplicate sql module. https://github.com/FreeRADIUS/freeradius-server/commit/bb842ece01025e40906f… Tried few method from mail list but none of them worked. What I am trying to do is change Mikrotik-Rate-Limit based on time by CoA. Thank you

2 3

Freeradius Accounting and Syslog server
by harshiva matcha 04 Mar '19

04 Mar '19

Hello Everyone! I am using Freeradius for Accounting and I was successful in configuring it. However, to process the logs and displaying them for further use, I would like to send them to syslog server. For me, it is easier to send to syslog if the logs are printed on STDOUT. Is there a way to print the Accounting logs on STDOUT or different way to send to syslog server? I have tried editing /etc/freeradius/modules/detail file to add follows- *detailfile = stdout* But this does not seem to be working. Please let me know, thank you

3 3